Discount list and amount discount_1c54.iso
- SHA256 01e9c5706e794095b22f76053c96f2e0f150d5a525d0b97af543f9865fb8b0c0
Password
spf200
Resubmissions
30/10/2026, 09:28
261030-lfbk3sa16t30/10/2026, 09:12
261030-k59zhaxxay1030/10/2026, 09:09
261030-k4glkaxwhy30/10/2026, 09:06
261030-k24y3sxz8j1030/10/2026, 08:41
261030-klfasaxy6k1030/10/2026, 08:08
261030-j1tahsxtfx1030/10/2026, 06:25
261030-g6nacadg491030/10/2026, 06:24
261030-g6az1swycv30/10/2026, 05:18
261030-fzj4nsww5j10Static task
static1
2 signatures
General
- Target Discount list and amount discount_1c54.iso
- Size 602KB
- Sample261030-k4glkaxwhy
- SHA256 01e9c5706e794095b22f76053c96f2e0f150d5a525d0b97af543f9865fb8b0c0
- MD5 cc53880ce75bd0b940ce148d3a165827
- SHA1 adc1bfc48d730f138ed988d5c2e89968d8cdfaf1
- SHA512 198cab5912cc54aad50ffc660e3d2ec956a27fb85f2a47beb816f1c0b3cddfb301f467a9b3fcdefbd4359d337dd6625c1e26230b33c1f31618c8097afb2b75ac
- SSDEEP 12288:/P48zmzxYVWls7fD7aJVIN2mmxiiTO9QvJj4EvQg:/P4OeYVn7L7xgmm79vJUE4g
- TLSH T179D4F119726461F2D432A278CA949256F772B81B177143DF738C86391F33FE66E39222
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/wmicodegen.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/wmicodegen.dll
File Explorer
-
Discount list and amount discount_1c54.iso.iso 602KB
-
out.iso.iso 602KB
-
Discount list and amount discount.exe.exe 174KB
-
wmicodegen.dll.dll 9KB
-
ws.png.png 364KB
out.iso
- SHA256 01e9c5706e794095b22f76053c96f2e0f150d5a525d0b97af543f9865fb8b0c0
- MD5 cc53880ce75bd0b940ce148d3a165827
- SHA1 adc1bfc48d730f138ed988d5c2e89968d8cdfaf1
- SHA512 198cab5912cc54aad50ffc660e3d2ec956a27fb85f2a47beb816f1c0b3cddfb301f467a9b3fcdefbd4359d337dd6625c1e26230b33c1f31618c8097afb2b75ac
- SSDEEP 12288:/P48zmzxYVWls7fD7aJVIN2mmxiiTO9QvJj4EvQg:/P4OeYVn7L7xgmm79vJUE4g
- TLSH T179D4F119726461F2D432A278CA949256F772B81B177143DF738C86391F33FE66E39222
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
spf200
Discount list and amount discount.exe
- IMPHASH 2aa2b758b667e9bc3668dd7e59073362
- SHA256 41d9c8f7662e76d62da7aac907d6419be76f60259241e16e7d8025ed4aa34d12
- MD5 bb97150614bcb7fba7040f6674037605
- SHA1 d3a6234a854886088eb29b21b26125b811a87768
- SHA512 32d77ccc2aec0cda4ef0eadb39a787221d25d7e0f01dcfa2dd23e94b8843037f70bccc6ffa33537acd01c1a04c03a3b0d108a7799abd4d73420d8ff26e8d62c4
- SSDEEP 3072:chlUYCVlFF4smO1RWUdESZhMiPx4DPmCJvo1aJBl0Zbln8D:chOY4tmOymfZJxAPj+sJsA
- TLSH T1C4048C5673A824F6D4728178CA959A56F772B42B033183DF035486791F33BEA6E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
spf200
Digest
cd:46:40:28:ab:a6:65:ca:88:cf:55:48:8f:eb:18:9e:00:9a:b4:91:13:f6:fa:b4:79:c0:fc:7f:fb:6c:f4:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Convert-MofToProvider.pdb
kernel32
CompareStringA
HeapSetInformation
SetThreadPreferredUILanguages
GetModuleHandleA
CreateFileW
WriteConsoleW
GetCommandLineA
GetVersionExW
RtlLookupFunctionEntry
RtlUnwindEx
ExitProcess
GetModuleHandleExW
GetProcAddress
GetLastError
MultiByteToWideChar
CreateDirectoryA
HeapAlloc
RtlPcToFileHeader
RaiseException
SetUnhandledExceptionFilter
EncodePointer
DecodePointer
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
GetStdHandle
WriteFile
GetModuleFileNameA
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
RtlUnwind
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
CloseHandle
HeapFree
GetLocaleInfoA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesA
GetStringTypeW
Sleep
LoadLibraryExW
IsProcessorFeaturePresent
CreateFileA
LCMapStringW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
ReadConsoleW
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
SetFilePointer
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
wmicodegen
GeneratorMain
err
ValidIdent
GeneratorAdapterCode
user32
LoadStringW
Name
.text
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=259, version=33145,
count=2, productName=Unmarked objects (old),
count=128, id=260, version=33145,
count=56, id=261, version=33145,
count=7, id=257, version=33145,
count=102, id=1, productName=Unmarked objects,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wmicodegen.dll
- IMPHASH 7ab454bd9cbaf1b3b527b365e6fefe48
- SHA256 9525e8f1e690a4d239d80b704c412dd31cd3fdcc54bce5a5fed5f389a988d9dd
- MD5 7625681382c65ec8013781479e4832a8
- SHA1 10391858a7e91b9f1cfa149251dab9e815ffbfd2
- SHA512 80b016df90490e01ff71afa78e217b0e024813323bfc1568893cd101a71b27e369cfef1af5334c0bea8f8775686681c8d9351505e4ca451d0992fd9a3f2f7f3b
- SSDEEP 192:hNR0WdCj8geSO6NHliq0CP7na/roS5H5P1aXBj7ioan:v9dvSF/iqbmjHEx5
- TLSH T13E124D07F49160FDCC27D3B543876036E6B5BC0DA971AA1EDF921B2135E1A10AB3DA8D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
spf200
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
ReleaseDC
GetDC
kernel32
GetTickCount
GeneratorAdapterCode
GeneratorMain
LookupString
ValidIdent
err
Name
.ntext
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rodata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cdata
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ws.png
- SHA256 3b23f6071336a924007944e451f295898cb12cff00326f2b3ebe4a04ddeeb5a6
- MD5 199e7c76abddf53e53dcc75ae6bfc783
- SHA1 0f60c5f57e5c71cef573479ba0dbdab36348595d
- SHA512 96323e3bc8f867d8877452f8f5cdc77850527bb066fda445c10e9dabe241a8c434cd6d6edc82e98507a8372c10c8391b3ce2c9bc5a23167ced9144c81221d34a
- SSDEEP 6144:alsA2nPLjcsbcqL+kq5zfwNM9mmxiiTiXNx1TYYl1BQacvBjzsrUZ4AQpud:als7fD7aJVIN2mmxiiTO9QvJj4EvQgd
- TLSH T1E884234CAA62E3335936B212D77CE3A5B0724A573B52011DD2C97538E139DB367E84E3
- MD5 SHA1 SHA512 SSDEEP TLSH